CVE-2021-37473

2021-07-2617:11:12

mitre

www.cve.org

navigatecms

sql injection

parameter vulnerability

post request

backend database

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

69.0%

JSON

In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter products-order through a post request, which results in arbitrary sql query execution in the backend database.

References

gist.github.com/victomteng1997/ed429fed7de46651c89f05e7591fd4fe

github.com/NavigateCMS/Navigate-CMS

github.com/NavigateCMS/Navigate-CMS/issues/26